name: "Rerun Remote Tests"

# Trigger: the "run-remote-tests" or "run-c3-frameworks-tests" label is added
# to or removed from a pull request.
#
# Goal: re-run the E2E workflows (e2e-wrangler.yml, e2e-vite.yml, c3-e2e.yml)
# so they pick up the label change and either pass or withhold the Cloudflare
# API token to the test steps. This avoids adding "labeled" as a trigger type
# to every E2E workflow (which would cause wasteful re-runs on unrelated label
# changes).
#
# Using pull_request_target (not pull_request) so the workflow has access to a
# privileged GITHUB_TOKEN even for fork PRs. This is safe because the workflow
# runs code from the default branch — fork authors cannot modify it — and only
# calls the Actions API (no checkout of untrusted code).
on:
  pull_request_target: # zizmor: ignore[dangerous-triggers] label-driven rerun workflow needs actions:write and does not check out or execute PR code
    types: [labeled, unlabeled]

permissions: {}

jobs:
  rerun-e2e:
    name: "Rerun E2E Tests"
    if: github.event.label.name == 'ci:run-remote-tests' || github.event.label.name == 'run-c3-frameworks-tests'
    runs-on: ubuntu-latest
    permissions:
      actions: write
    steps:
      - name: "Re-run E2E workflows"
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
          LABEL_NAME: ${{ github.event.label.name }}
          REPO: ${{ github.repository }}
        run: |
          # Determine which workflows to re-run based on the label.
          if [ "$LABEL_NAME" = "ci:run-remote-tests" ]; then
            WORKFLOWS="e2e-wrangler.yml e2e-vite.yml c3-e2e.yml"
          else
            WORKFLOWS="c3-e2e.yml"
          fi

          for workflow in ${WORKFLOWS}; do
            # Find the most recent run of this workflow at the PR head SHA.
            run_info=$(gh api "repos/${REPO}/actions/workflows/${workflow}/runs?head_sha=${HEAD_SHA}&per_page=1" \
              --jq '.workflow_runs[0] | "\(.id) \(.status)"' || true)

            run_id=$(echo "$run_info" | awk '{print $1}')
            status=$(echo "$run_info" | awk '{print $2}')

            if [ -z "$run_id" ] || [ "$run_id" = "null" ]; then
              echo "::warning::No run found for ${workflow} at SHA ${HEAD_SHA}"
              continue
            fi

            # Runs that haven't started yet will see the newly-added label
            # when they begin — no need to cancel and re-run them.
            if [ "$status" != "completed" ] && [ "$status" != "in_progress" ]; then
              echo "${workflow} run ${run_id} is ${status} — not yet started, skipping."
              continue
            fi

            # If the run is actively executing, the label check has already
            # evaluated (likely to the old value). Cancel it first — the
            # rerun endpoint only works on completed runs.
            if [ "$status" = "in_progress" ]; then
              echo "Cancelling in-progress ${workflow} run ${run_id}..."
              gh api "repos/${REPO}/actions/runs/${run_id}/cancel" --method POST || true

              # Cancellation is async; poll until the run reaches "completed".
              for i in $(seq 1 30); do
                current=$(gh api "repos/${REPO}/actions/runs/${run_id}" --jq '.status')
                if [ "$current" = "completed" ]; then
                  echo "Run ${run_id} is now completed (cancelled)."
                  break
                fi
                echo "  Waiting for cancellation to finish (${i}/30, status: ${current})..."
                sleep 2
              done
            fi

            gh api "repos/${REPO}/actions/runs/${run_id}/rerun" --method POST \
              && echo "Re-triggered ${workflow} (run ${run_id})" \
              || echo "::warning::Failed to re-run ${workflow} (run ${run_id})"
          done